2.8
中危
DACN
0.12
FACILE
1.00
IMCLNet
0.49
MFGraph
0.00
反病毒引擎
未检测
暂无反病毒引擎检测结果
静态指标
查询计算机名称
(1 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545302.5305 GetComputerNameW |
computer_name:
TU-PC
|
success | 1 | 0 |
检查进程是否被调试器调试
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545285.672125 IsDebuggerPresent |
failed | 0 | 0 | |
|
1727545292.4845 IsDebuggerPresent |
failed | 0 | 0 |
观察到命令行控制台输出
(2 个事件)
检查系统中的内存量，这可以用于检测可用内存较少的虚拟机
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545292.063125 GlobalMemoryStatusEx |
success | 1 | 0 | |
|
1727545302.5625 GlobalMemoryStatusEx |
success | 1 | 0 |
一个或多个进程崩溃
(1 个事件)
动态指标
分配可读-可写-可执行内存（通常用于自解压）
(39 个事件)
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe |
检查系统上可疑权限的本地唯一标识符
(1 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545305.2655 LookupPrivilegeValueW |
system_name:
privilege_name: SeDebugPrivilege |
success | 1 | 0 |
使用 Windows 工具进行基本 Windows 功能
(1 个事件)
| cmdline | netsh firewall add allowedprogram "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" "pcbs_install.exe" ENABLE |
网络通信
与未执行 DNS 查询的主机进行通信
(3 个事件)
| host | 185.27.134.11 | |||
| host | 114.114.114.114 | |||
| host | 73.31.182.30 | |||
在 Windows 启动时自我安装以实现自动运行
(50 out of 88 个事件)
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\873109f217f59daee301b7afa01452c7 | reg_value | "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" .. | ||||||
连接到不再响应请求的 IP 地址（合法服务通常会保持运行）
(1 个事件)
| dead_host | 73.31.182.30:500 |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2020-05-05 10:04:51
PE Imphash
f34d5f2d4577ed6d9ceec516c1f5a744
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00002000 | 0x00005494 | 0x00005600 | 5.571193740238202 |
| .rsrc | 0x00008000 | 0x00000240 | 0x00000400 | 4.966081339698093 |
| .reloc | 0x0000a000 | 0x0000000c | 0x00000200 | 0.08153941234324169 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_MANIFEST | 0x00008058 | 0x000001e7 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
Imports
Library mscoree.dll:
• 0x402000 _CorExeMain
L!This program cannot be run in DOS mode.
`.rsrc
@.reloc
1 (u
v2.0.50727
#Strings
<Module>
System.Runtime.CompilerServices
CompilationRelaxationsAttribute
RuntimeCompatibilityAttribute
System
Object
Microsoft.VisualBasic.CompilerServices
StandardModuleAttribute
System.IO
FileInfo
FileStream
Microsoft.VisualBasic.Devices
Computer
System.Net.Sockets
TcpClient
MemoryStream
Conversions
ToBoolean
System.Reflection
Assembly
GetEntryAssembly
get_Location
Exception
Microsoft.VisualBasic.MyServices
RegistryProxy
ServerComputer
get_Registry
Microsoft.Win32
RegistryKey
get_CurrentUser
String
Concat
OpenSubKey
DeleteValue
ProjectData
SetProjectError
ClearProjectError
RuntimeHelpers
GetObjectValue
GetValue
RegistryValueKind
CreateSubKey
SetValue
DateTime
Operators
ConditionalCompareObjectEqual
ToString
Environment
get_MachineName
get_UserName
FileSystemInfo
get_LastWriteTime
get_Date
ComputerInfo
get_Info
get_OSFullName
Replace
OperatingSystem
get_OSVersion
get_ServicePack
Microsoft.VisualBasic
Strings
CompareMethod
SpecialFolder
GetFolderPath
Contains
RegistryKeyPermissionCheck
GetValueNames
get_Length
Convert
ToBase64String
FromBase64String
System.Text
Encoding
get_UTF8
GetBytes
GetString
System.IO.Compression
GZipStream
Stream
CompressionMode
set_Position
BitConverter
ToInt32
Dispose
IntPtr
op_Equality
op_Explicit
Interaction
Environ
Conversion
Module
GetModules
GetTypes
get_FullName
EndsWith
get_Assembly
CreateInstance
DirectoryInfo
get_Name
ToLower
CompareString
get_Directory
get_Parent
get_LocalMachine
AppWinStyle
Delete
DeleteSubKey
EndApp
System.Threading
Thread
Exists
FileMode
ReadAllBytes
System.Diagnostics
Process
EnvironmentVariableTarget
SetEnvironmentVariable
System.Net
WebClient
System.Drawing
Graphics
Bitmap
Rectangle
ConcatenateObject
get_Chars
ToArray
DownloadData
GetTempFileName
WriteAllBytes
get_Message
NewLateBinding
LateSet
LateCall
Boolean
LateGet
CompareObjectEqual
OrObject
System.Windows.Forms
Screen
get_PrimaryScreen
get_Bounds
get_Width
get_Height
System.Drawing.Imaging
PixelFormat
FromImage
CopyPixelOperation
CopyFromScreen
Cursor
Cursors
get_Default
get_Position
ToInteger
DrawImage
ImageFormat
get_Jpeg
WriteByte
RuntimeTypeHandle
GetTypeFromHandle
ChangeType
System.Security.Cryptography
MD5CryptoServiceProvider
HashAlgorithm
ComputeHash
GetCurrentProcess
get_Handle
Monitor
Socket
get_Client
SocketFlags
set_ReceiveBufferSize
set_SendBufferSize
set_SendTimeout
set_ReceiveTimeout
Connect
get_Available
SelectMode
NetworkStream
GetStream
ReadByte
ToLong
Receive
ParameterizedThreadStart
Command
ThreadStart
SessionEndingEventArgs
SessionEndingEventHandler
SystemEvents
add_SessionEnding
Application
DoEvents
set_MinWorkingSet
ConditionalCompareObjectNotEqual
CompilerGeneratedAttribute
DebuggerStepThroughAttribute
STAThreadAttribute
StringBuilder
GetProcessById
get_MainWindowTitle
DateAndTime
get_Now
get_ProcessName
Keyboard
get_Keyboard
get_ShiftKeyDown
get_CapsLock
ToUpper
get_CtrlKeyDown
Remove
avicap32.dll
kernel32
user32.dll
user32
mscorlib
lastcap
.cctor
NtSetInformationProcess
hProcess
processInformationClass
processInformation
processInformationLength
capGetDriverDescriptionA
wDriver
lpszName
cbName
lpszVer
GetVolumeInformation
GetVolumeInformationA
lpRootPathName
lpVolumeNameBuffer
nVolumeNameSize
lpVolumeSerialNumber
lpMaximumComponentLength
lpFileSystemFlags
lpFileSystemNameBuffer
nFileSystemNameSize
GetForegroundWindow
GetWindowText
GetWindowTextA
WinTitle
MaxLength
GetWindowTextLength
GetWindowTextLengthA
Plugin
CompDir
connect
_Lambda$__1
_Lambda$__2
LastAV
LastAS
lastKey
ToUnicodeEx
GetKeyboardState
MapVirtualKey
GetWindowThreadProcessId
GetKeyboardLayout
GetAsyncKeyState
VKCodeToUnicode
WrapNonExceptionThrows
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
PPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
x a d e f g
S G F j S 2 V k
p c b s _ i n s t a l l . e x e
8 7 3 1 0 9 f 2 1 7 f 5 9 d a e e 3 0 1 b 7 a f a 0 1 4 5 2 c 7
7 3 . 3 1 . 1 8 2 . 3 0
S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ R u n
S o f t w a r e \
y y - M M - d d
? ? - ? ? - ? ?
M i c r o s o f t
W i n d o w s
S y s t e m D r i v e
n e t s h f i r e w a l l d e l e t e a l l o w e d p r o g r a m "
S o f t w a r e
c m d . e x e / c p i n g 0 - n 2 & d e l "
S E E _ M A S K _ N O Z O N E C H E C K S
n e t s h f i r e w a l l a d d a l l o w e d p r o g r a m "
" E N A B L E
g e t v a l u e
E x e c u t e E R R O R
D o w n l o a d E R R O R
E x e c u t e d A s
E x e c u t e E R R O R
U p d a t e E R R O R
U p d a t i n g T o
U p d a t e E R R O R
y y / M M / d d
[ E N T E R ]
Process Tree
-
02d1241d4a6b4732bdbe1723fd77493e6386f3a373f41281d002877b67a3e5f8.exe (3028)
"C:\Users\Administrator\AppData\Local\Temp\02d1241d4a6b4732bdbe1723fd77493e6386f3a373f41281d002877b67a3e5f8.exe"
-
pcbs_install.exe (3008)
"C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe"
- netsh.exe (2444) netsh firewall add allowedprogram "C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe" "pcbs_install.exe" ENABLE
-
pcbs_install.exe (3008)
"C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe"
02d1241d4a6b4732bdbe1723fd77493e6386f3a373f41281d002877b67a3e5f8.exe, PID: 3028, Parent PID: 2600
default registry file network process services synchronisation iexplore office pdf
Hosts
| IP |
|---|
| 185.27.134.11 |
| 114.114.114.114 |
| 73.31.182.30 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 185.27.134.11 | 21 | 192.168.56.101 | 49165 |
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | 02d1241d4a6b4732_pcbs_install.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\pcbs_install.exe |
| Size | 23.5KB |
| Processes | 3028 (02d1241d4a6b4732bdbe1723fd77493e6386f3a373f41281d002877b67a3e5f8.exe) |
| Type | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5 | 58e06f93adc72d9615806e136e1d672a |
| SHA1 | 83d10cda42966901eea0bc76510dc34977105f6f |
| SHA256 | 02d1241d4a6b4732bdbe1723fd77493e6386f3a373f41281d002877b67a3e5f8 |
| CRC32 | 33FC6F0A |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.